VYPR
← All advisories
High severity7.8NVD Advisory· Published Nov 19, 2024· Updated May 12, 2026

CVE-2024-53059

CVE-2024-53059

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()

  1. The size of the response packet is not validated.
  2. The response buffer is not freed.

Resolve these issues by switching to iwl_mvm_send_cmd_status(), which handles both size validation and frees the buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's iwlwifi driver, improper response handling in iwl_mvm_send_recovery_cmd() leads to missing size validation and a memory leak, potentially causing system instability.

CVE-2024-53059 is a vulnerability in the Linux kernel's iwlwifi wireless driver, specifically in the iwl_mvm_send_recovery_cmd() function. The function fails to validate the size of the response packet and does not free the response buffer after use, leading to potential memory corruption and resource exhaustion.

An attacker with local access and the ability to trigger the recovery command could exploit this flaw. The missing size validation may allow a crafted response to cause out-of-bounds reads or writes, while the unfreed buffer leads to a memory leak over time.

Successful exploitation could result in a denial of service due to system crash or memory exhaustion, and potentially information disclosure if sensitive kernel memory is exposed. The vulnerability is rated High with a CVSS v3 score of 7.8, indicating significant local impact.

The fix was committed in the Linux kernel by switching to iwl_mvm_send_cmd_status(), which properly validates response sizes and frees the buffer. Users should apply the latest kernel updates from their distribution or the stable kernel tree [3][4].

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

103

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.